Moving a portion of a streaming application to a public cloud based on sensitive data

ABSTRACT

A streams manager determines which portions of a streaming application process sensitive data, and when performance of the streaming application needs to be increased, selects based on the sensitive data which portion(s) of the streaming application can be moved to a public cloud. The streams manager then interacts with the public cloud manager to move the selected portion(s) of the streaming application to the public cloud. This may include cloning of processing elements or operators to a public cloud, then splitting tuple attributes so tuple attributes that do not include sensitive data can be processed in the public cloud while tuple attributes that include sensitive data are processed in a secure system. The tuple attributes are then recombined into full tuples in the secure system. The streams manager thus protects the integrity of sensitive data while still taking advantage of the additional resources available in a public cloud.

BACKGROUND

1. Technical Field

This disclosure generally relates to streaming applications, and morespecifically relates to moving a portion of a streaming application to apublic cloud based on sensitive data.

2. Background Art

Streaming applications are known in the art, and typically includemultiple processing elements coupled together in a flow graph thatprocess streaming data in near real-time. A processing element typicallytakes in streaming data in the form of data tuples, operates on the datatuples in some fashion, and outputs the processed data tuples to thenext processing element. Streaming applications are becoming more commondue to the high performance that can be achieved from near real-timeprocessing of streaming data.

Many streaming applications require significant computer resources, suchas processors and memory, to provide the desired near real-timeprocessing of data. However, the workload of a streaming application canvary greatly over time. Allocating on a permanent basis computerresources to a streaming application that would assure the streamingapplication would always function as desired (i.e., during peak demand)would mean many of those resources would sit idle when the streamingapplication is processing a workload significantly less than itsmaximum. Furthermore, what constitutes peak demand at one point in timecan be exceeded as the usage of the streaming application increases. Fora dedicated system that runs a streaming application, an increase indemand may require a corresponding increase in hardware resources tomeet that demand.

BRIEF SUMMARY

A streams manager determines which portions of a streaming applicationprocess sensitive data, and when performance of the streamingapplication needs to be increased, selects based on the sensitive datawhich portion(s) of the streaming application can be moved to a publiccloud. The streams manager then interacts with the public cloud managerto move the selected portion(s) of the streaming application to thepublic cloud. This may include cloning of processing elements oroperators to a public cloud, then splitting tuple attributes so tupleattributes that do not include sensitive data can be processed in thepublic cloud while tuple attributes that include sensitive data areprocessed in a secure system. The tuple attributes are then recombinedinto full tuples in the secure system. The streams manager thus protectsthe integrity of sensitive data while still taking advantage of theadditional resources available in a public cloud.

The foregoing and other features and advantages will be apparent fromthe following more particular description, as illustrated in theaccompanying drawings.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING(S)

The disclosure will be described in conjunction with the appendeddrawings, where like designations denote like elements, and:

FIG. 1 is a block diagram of a cloud computing node;

FIG. 2 is a block diagram of a cloud computing environment;

FIG. 3 is a block diagram of abstraction model layers;

FIG. 4 is a block diagram showing some features of a public cloudmanager;

FIG. 5 is block diagram showing features of a streams manager that canmove a portion of a streaming application to a public cloud takingsensitive data into account;

FIG. 6 is a flow diagram of a method for the streams manager to move aportion of a streaming application to a public cloud based on sensitivedata;

FIG. 7 is a flow diagram of a method for a streams manager to interactwith a public cloud manager to move selected portion(s) of a streamingapplication to a public cloud;

FIG. 8 is a block diagram of a table showing examples of sensitive datasplit criteria;

FIG. 9 is a block diagram showing a specific example of a flow graphcorresponding to a streaming application;

FIG. 10 is a block diagram showing a first example of how a portion ofthe flow graph in FIG. 9 can be moved to a public cloud based onsensitive data;

FIG. 11 is a block diagram showing a second example of how a portion ofthe flow graph in FIG. 9 can be moved to a public cloud based onsensitive data;

FIG. 12 is a block diagram showing a third example of how a portion ofthe flow graph in FIG. 9 can be moved to a public cloud based onsensitive data;

FIG. 13 is a block diagram showing a fourth example of how a portion ofthe flow graph in FIG. 9 can be moved to a public cloud based onsensitive data;

FIG. 14 shows a sample tuple comprised of four attributes;

FIG. 15 is a table showing whether the attributes in the tuple in FIG.14 include sensitive data or not;

FIG. 16 is a block diagram showing a fifth example of how a portion ofthe flow graph in FIG. 9 can be moved to a public cloud based onsensitive data by splitting attributes of a tuple based on sensitivedata; and

FIG. 17 is a flow diagram of a method for a streams manager to move aportion of a flow graph to a public cloud by splitting tuples andcloning one or more processing elements to a public cloud.

DETAILED DESCRIPTION

The disclosure and claims herein relate to a streams manager thatdetermines which portions of a streaming application process sensitivedata, and when performance of the streaming application needs to beincreased, selects based on the sensitive data which portion(s) of thestreaming application can be moved to a public cloud. The streamsmanager then interacts with the public cloud manager to move theselected portion(s) of the streaming application to the public cloud.This may include cloning of processing elements or operators to a publiccloud, then splitting tuple attributes so tuple attributes that do notinclude sensitive data can be processed in the public cloud while tupleattributes that include sensitive data are processed in a secure system.The tuple attributes are then recombined into full tuples in the securesystem. The streams manager thus protects the integrity of sensitivedata while still taking advantage of the additional resources availablein a public cloud.

It is understood in advance that although this disclosure includes adetailed description on cloud computing, implementation of the teachingsrecited herein are not limited to a cloud computing environment. Rather,embodiments of the present invention are capable of being implemented inconjunction with any other type of computing environment now known orlater developed.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g. networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter).

Rapid elasticity: capabilities can be rapidly and elasticallyprovisioned, in some cases automatically, to quickly scale out andrapidly released to quickly scale in. To the consumer, the capabilitiesavailable for provisioning often appear to be unlimited and can bepurchased in any quantity at any time.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active user accounts). Resource usage can bemonitored, controlled, and reported providing transparency for both theprovider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based email). Theconsumer does not manage or control the underlying cloud infrastructureincluding network, servers, operating systems, storage, or evenindividual application capabilities, with the possible exception oflimited user-specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off-premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forloadbalancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure comprising anetwork of interconnected nodes.

Referring now to FIG. 1, a block diagram of an example of a cloudcomputing node is shown. Cloud computing node 100 is only one example ofa suitable cloud computing node and is not intended to suggest anylimitation as to the scope of use or functionality of embodiments of theinvention described herein. Regardless, cloud computing node 100 iscapable of being implemented and/or performing any of the functionalityset forth hereinabove.

In cloud computing node 100 there is a computer system/server 110, whichis operational with numerous other general purpose or special purposecomputing system environments or configurations. Examples of well-knowncomputing systems, environments, and/or configurations that may besuitable for use with computer system/server 110 include, but are notlimited to, personal computer systems, server computer systems, thinclients, thick clients, handheld or laptop devices, multiprocessorsystems, microprocessor-based systems, set top boxes, programmableconsumer electronics, network PCs, minicomputer systems, mainframecomputer systems, and distributed cloud computing environments thatinclude any of the above systems or devices, and the like.

Computer system/server 110 may be described in the general context ofcomputer system executable instructions, such as program modules, beingexecuted by a computer system. Generally, program modules may includeroutines, programs, objects, components, logic, data structures, and soon that perform particular tasks or implement particular abstract datatypes. Computer system/server 110 may be practiced in distributed cloudcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed cloud computing environment, program modules may be locatedin both local and remote computer system storage media including memorystorage devices.

As shown in FIG. 1, computer system/server 110 in cloud computing node100 is shown in the form of a general-purpose computing device. Thecomponents of computer system/server 110 may include, but are notlimited to, one or more processors or processing units 120, a systemmemory 130, and a bus 122 that couples various system componentsincluding system memory 130 to processor 120.

Bus 122 represents one or more of any of several types of busstructures, including a memory bus or memory controller, a peripheralbus, an accelerated graphics port, and a processor or local bus usingany of a variety of bus architectures. By way of example, and notlimitation, such architectures include Industry Standard Architecture(ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA)bus, Video Electronics Standards Association (VESA) local bus, andPeripheral Component Interconnect (PCI) bus.

Computer system/server 110 typically includes a variety of computersystem readable media. Such media may be any available media that isaccessible by computer system/server 110, and it includes both volatileand non-volatile media, removable and non-removable media.

System memory 130 can include computer system readable media in the formof volatile, such as random access memory (RAM) 134, and/or cache memory136. Computer system/server 110 may further include otherremovable/non-removable, volatile/non-volatile computer system storagemedia. By way of example only, storage system 140 can be provided forreading from and writing to a non-removable, non-volatile magnetic media(not shown and typically called a “hard drive”). Although not shown, amagnetic disk drive for reading from and writing to a removable,non-volatile magnetic disk (e.g., a “floppy disk”), and an optical diskdrive for reading from or writing to a removable, non-volatile opticaldisk such as a CD-ROM, DVD-ROM or other optical media can be provided.In such instances, each can be connected to bus 122 by one or more datamedia interfaces. As will be further depicted and described below,memory 130 may include at least one program product having a set (e.g.,at least one) of program modules that are configured to carry out thefunctions described in more detail below.

Program/utility 150, having a set (at least one) of program modules 152,may be stored in memory 130 by way of example, and not limitation, aswell as an operating system, one or more application programs, otherprogram modules, and program data. Each of the operating system, one ormore application programs, other program modules, and program data orsome combination thereof, may include an implementation of a networkingenvironment. Program modules 152 generally carry out the functionsand/or methodologies of embodiments of the invention as describedherein.

Computer system/server 110 may also communicate with one or moreexternal devices 190 such as a keyboard, a pointing device, a display180, a disk drive, etc.; one or more devices that enable a user tointeract with computer system/server 110; and/or any devices (e.g.,network card, modem, etc.) that enable computer system/server 110 tocommunicate with one or more other computing devices. Such communicationcan occur via Input/Output (I/O) interfaces 170. Still yet, computersystem/server 110 can communicate with one or more networks such as alocal area network (LAN), a general wide area network (WAN), and/or apublic network (e.g., the Internet) via network adapter 160. Asdepicted, network adapter 160 communicates with the other components ofcomputer system/server 110 via bus 122. It should be understood thatalthough not shown, other hardware and/or software components could beused in conjunction with computer system/server 110. Examples, include,but are not limited to: microcode, device drivers, redundant processingunits, external disk drive arrays, RAID systems, tape drives, dataarchival storage systems, etc.

Referring now to FIG. 2, illustrative cloud computing environment 200 isdepicted. As shown, cloud computing environment 200 comprises one ormore cloud computing nodes 100 with which local computing devices usedby cloud consumers, such as, for example, personal digital assistant(PDA) or cellular telephone 210A, desktop computer 210B, laptop computer210C, and/or automobile computer system 210N may communicate. Nodes 100may communicate with one another. They may be grouped (not shown)physically or virtually, in one or more networks, such as Private,Community, Public, or Hybrid clouds as described hereinabove, or acombination thereof. This allows cloud computing environment 200 tooffer infrastructure, platforms and/or software as services for which acloud consumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 210A-Nshown in FIG. 2 are intended to be illustrative only and that computingnodes 100 and cloud computing environment 200 can communicate with anytype of computerized device over any type of network and/or networkaddressable connection (e.g., using a web browser).

Referring now to FIG. 3, a set of functional abstraction layers providedby cloud computing environment 200 (FIG. 2) is shown. It should beunderstood in advance that the components, layers, and functions shownin FIG. 3 are intended to be illustrative only and the disclosure andclaims are not limited thereto. As depicted, the following layers andcorresponding functions are provided.

Hardware and software layer 310 includes hardware and softwarecomponents. Examples of hardware components include mainframes 352; RISC(Reduced Instruction Set Computer) architecture based servers 354;servers 356; blade servers 358; storage devices 360; and networks andnetworking components 362. In some embodiments, software componentsinclude network application server software 364 and database software366.

Virtualization layer 320 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers368; virtual storage 370; virtual networks 372, including virtualprivate networks; virtual applications and operating systems 374; andvirtual clients 376.

In one example, management layer 330 may provide the functions describedbelow. Resource provisioning 378 provides dynamic procurement ofcomputing resources and other resources that are utilized to performtasks within the cloud computing environment. Metering and Pricing 380provide cost tracking as resources are utilized within the cloudcomputing environment, and billing or invoicing for consumption of theseresources. In one example, these resources may comprise applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal 382 provides access to the cloud computing environment forconsumers and system administrators. Service level management 384provides cloud computing resource allocation and management such thatrequired service levels are met. Service Level Agreement (SLA) planningand fulfillment 386 provide pre-arrangement for, and procurement of,cloud computing resources for which a future requirement is anticipatedin accordance with an SLA. The management layer further includes astreams manager (SM) 360 as described herein. While the streams manager360 is shown in FIG. 3 to reside in the management layer 330, thestreams manager 360 actually may span other levels shown in FIG. 3 asneeded.

Workloads layer 340 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation 386; software development and lifecycle management 390;virtual classroom education delivery 392; data analytics processing 394;transaction processing 396 and mobile desktop 398.

As will be appreciated by one skilled in the art, aspects of thisdisclosure may be embodied as a system, method or computer programproduct. Accordingly, aspects may take the form of an entirely hardwareembodiment, an entirely software embodiment (including firmware,resident software, micro-code, etc.) or an embodiment combining softwareand hardware aspects that may all generally be referred to herein as a“circuit,” “module” or “system.” Furthermore, aspects of the presentinvention may take the form of a computer program product embodied inone or more computer readable medium(s) having computer readable programcode embodied thereon.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a non-transitory computer readable storage medium. A computerreadable storage medium may be, for example, but not limited to, anelectronic, magnetic, optical, electromagnetic, infrared, orsemiconductor system, apparatus, or device, or any suitable combinationof the foregoing. More specific examples (a non-exhaustive list) of thecomputer readable storage medium would include the following: anelectrical connection having one or more wires, a portable computerdiskette, a hard disk, a random access memory (RAM), a read-only memory(ROM), an erasable programmable read-only memory (EPROM or Flashmemory), an optical fiber, a portable compact disc read-only memory(CD-ROM), an optical storage device, a magnetic storage device, or anysuitable combination of the foregoing. In the context of this document,a computer readable storage medium may be any tangible medium that cancontain, or store a program for use by or in connection with aninstruction execution system, apparatus, or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Aspects of the present invention are described below with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other devices to causea series of operational steps to be performed on the computer, otherprogrammable apparatus or other devices to produce a computerimplemented process such that the instructions which execute on thecomputer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system, method or computer programproduct. Accordingly, aspects of the present invention may take the formof an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present invention may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

FIG. 4 shows one suitable example of a public cloud manager 402. Thepublic cloud manager 402 could reside in the management layer 330 shownin FIG. 3, or could span multiple levels shown in FIG. 3. The publiccloud manager 402 includes a cloud provisioning mechanism 410 thatincludes a resource request interface 420. The resource requestinterface 420 allows a software entity, such as the streams manager 360,to request virtual machines from the public cloud manager 402 withouthuman intervention. The public cloud manager 402 also includes a userinterface 430 that allows a user to interact with the public cloudmanager to perform any suitable function, including provisioning of VMs,destruction of VMs, performance analysis of the cloud, etc. Thedifference between the resource request interface 420 and the userinterface 430 is a user must manually use the user interface 430 toperform functions specified by the user, while the resource requestinterface 420 may be used by a software entity to request provisioningof cloud resources by the public cloud manager 402 without input from ahuman user. Of course, public cloud manager 402 could include many otherfeatures and functions known in the art that are not shown in FIG. 4.

FIG. 5 shows one suitable example of the streams manager 360 shown inFIG. 3. The streams manager 360 is software that manages one or morestreaming applications 502, including creating operators and data flowconnections between operators in a flow graph that represents astreaming application 502. The streams manager 360 includes aperformance monitor 510 with one or more performance thresholds 520.Performance thresholds 520 can include static thresholds, such aspercentage used of current capacity, and can also include any suitableheuristic for measuring performance of a streaming application as awhole or for measuring performance of one or more operators orprocessing elements in a streaming application. Performance thresholds520 may include different thresholds and metrics at the operator level,at the level of a group of operators, at the level of processingelements that include multiple operators, and/or at the level of theoverall performance of the streaming application. Performance of astreaming application may also be measured by comparing currentperformance to past performance in one or more historical logs 522. Notethe performance measured can include performance for a single operator,performance for a group of operators, performance for processingelements that include multiple operators, and performance for thestreaming application as a whole.

The stream performance monitor 510 also includes a sensitive datamonitor 524 that monitors the streaming application 502 and determineswhich portions of the streaming application 502 process sensitive dataand which do not. The term “sensitive data” can include any type of datathat needs to be protected based on any suitable criteria. Examples ofdifferent categories of sensitive data include: financial data; personaldata; company data; employee data; trade secrets; customer data;confidential information; medical data, etc. Any type of data that mightneed to be protected could fall within the scope of “sensitive data” asdescribed herein. In addition, a user could specify which data issensitive data by either manually identifying sensitive data or byemploying text analytics over the data to scan the data for stringfields that may look like sensitive data or match a pattern thatindicates is may be sensitive data.

The stream performance monitor 510 monitors performance of a streamingapplication, and when current performance compared to the one or moreperformance thresholds 520 or one or more historical logs 522 indicatescurrent performance needs to be improved, the streams manager 360 thendetermines how to split the flow graph based on sensitive data and howto deploy a portion of the flow graph to one or more VMs in a publiccloud. This is done using the flow graph split mechanism 530, whichoperates according to one or more sensitive data split criteria 532 thatspecifies one or more criterion for determining how to split a flowgraph based on sensitive data. The flow graph split mechanism 530determines how to split the flow graph into multiple portions based onwhich portions process sensitive data according to the sensitive datamonitor 524. One or more portions of the flow graph can then be deployedto a virtual machine in a public cloud. Once the portion(s) to bedeployed to a virtual machine in a public cloud are selected, thestreams manager 360 communicates the need for resources to the cloudresource request mechanism 540. The cloud resource request mechanism540, in response to the communication from the stream performancemonitor, assembles a cloud resource request 550, which can includeinformation such as a number of VMs to provision 560, streaminfrastructure needed in each VM 570, and a stream application portion580 for each VM. Once the cloud resource request 550 is formulated, thestreams manager 360 submits the cloud resource request 550 to a publiccloud manager, such as public cloud manager 402 shown in FIG. 4.

The cloud resource request can be formatted in any suitable way. Asimple example will illustrate two suitable ways for formatting a cloudresource request. Let's assume the streams manager determines it needstwo VMs, where both have common stream infrastructure, with a first ofthe VMs hosting operator A and the second of the VMs hosting operator B.The cloud resource request 550 in FIG. 5 could specify two VMs at 560,could specify the common stream infrastructure, such as an operatingsystem and middleware, at 570, and could specify operator A and operatorB at 580. In response, the cloud manager would provision two VMs withthe common stream infrastructure, with the first of the VMs hostingoperator A and the second of the VMs hosting operator B. In thealternative, the cloud resource request 550 could be formulated suchthat each VM is specified with its corresponding stream infrastructureand stream application portion. In this configuration, the cloudresource request would specify a first VM with the common streaminfrastructure and operator A, and a second VM with the common streaminfrastructure and operator B. Of course, multiple operators could alsobe deployed to a single VM.

Referring to FIG. 6, a method 600 shows one suitable example forenhancing performance of a streaming application, and is preferablyperformed by the streams manager 360 interacting with the public cloudmanager 402. The streams manager monitors performance of the flow graph(step 610). When performance does not need to be increased (step620=NO), method 600 loops back to step 610 and continues. Whenperformance needs to be increased (step 620=YES), the streams managerselects based on sensitive data split criteria which portions(s) of thestreaming application can be moved to a public cloud (step 630). Thestreams manager then moves one or more of the selected portion(s) to apublic cloud (step 640). Method 600 is then done. Method 600 allows astreams manager to make intelligent decisions regarding how to split aflow graph based on sensitive data so one or more of the portions may bedeployed to a virtual machine in a public cloud without compromisingsensitive data.

Referring to FIG. 7, a method 700 shows one suitable example forenhancing performance of a streaming application, and is preferablyperformed by the streams manager 360 interacting with the public cloudmanager 402. Method 700 is one suitable implementation for step 640 inFIG. 6. The streams manager requests resources, such as VMs, from thecloud manager with specified streams infrastructure and specifiedstreams application components (step 710). The public cloud managerprovisions the VMs with the specified streams infrastructure andspecified streams application component(s) for the streams manager (step720). The streams manager includes the VM(s) in the set of hostsavailable to the streaming application (step 630). The streams managerthen modifies the flow graph so one or more portions are hosted by oneor more VMs in the public cloud (step 740).

FIG. 8 shows a table that includes some examples of sensitive data splitcriteria 532 shown in FIG. 5. Connected processing elements that do notprocess sensitive data is shown at 810. This means multiple operators ormultiple processing elements that each includes one or more operatorsthat are connected and do not process sensitive data are candidates tobe moved to a public cloud. Individual processing elements that do notprocess sensitive data is shown at 820. With this criteria 820,individual operators or processing elements could be moved to a publiccloud even when they are not connected to other operators or processingelements. Processing elements that process sensitive data that can beencrypted is shown at 830. Because encrypting and decrypting datanecessarily comes at a cost due to the time needed to encrypt anddecrypt the data, this cost can be balanced and traded off for thebenefit of being able to move some of the operators or processingelements to a public cloud. For example, in a large streamingapplication, it may be possible to offload hundreds or even thousands ofconnected operators or processing elements to a public cloud by simplyencrypting once when the data goes to the public cloud and decryptingonce when the processed data returns from the public cloud. In thisscenario, the benefit of offloading such a large portion of thestreaming application to the public cloud may significantly outweigh theadditional overhead of the encryption and decryption. Processingelements that can be unfused so operators within the processing elementsdo not process sensitive data is shown at 840. This means it is possibleto unfuse processing elements comprised of multiple operators, then movejust those operators that do not process sensitive data to a publiccloud. Tuples that can have attributes split and operator(s) cloned sonon-sensitive data is sent to a public cloud is shown at 850. This meansthat a tuple's attributes may be split between attributes that includesensitive data and attributes that do not include sensitive data, withthe attributes that include sensitive data being processed by operatorsor processing elements in a secure system, while the attributes that donot include sensitive data can be processed by cloned operators orcloned processing elements in a public cloud. Examples of these fivesensitive data split criteria 810, 820, 830, 840 and 850 are discussedbelow.

A very simple flow graph is shown at 900 in FIG. 9 for the purpose ofillustrating the concepts herein. A streaming application 900 includesprocessing elements A, B, C, D, E, F, G, H, I and J as shown. Processingelement A originates a stream of tuples, which is processed byprocessing element B, which outputs tuples. The tuples from processingelement B are processed by processing element C, which outputs tuples toprocessing element D, which processes the tuples and outputs its tuplesto processing element H. In similar fashion, processing element Eoriginates a stream of tuples, which is processed by processing elementF, which outputs tuples that are processed by processing element G,which outputs tuples to processing element H. Note that processingelement H receives tuples from both processing element D and processingelement G. Processing element H processes the tuples it receives fromprocessing element D and from processing element G, and outputs itstuples to processing elements I and J. We assume for this example thestreaming application 900 initially runs on a dedicated system 910, suchas a computer system/server 100 shown in FIG. 1. Dedicated system 910 isan example of a secure system, which denotes a system not in a publiccloud that can process sensitive data.

For this specific example, the stream performance monitor 510 in FIG. 5monitors performance of the streaming application 900 in FIG. 9 inaccordance with one or more defined performance thresholds 520. Anexample of a suitable performance threshold 520 is percent of capacityused. A performance threshold of say, 80% could be specified for thestreaming application 900 as a whole. Note a performance threshold canapply to a specified operator, to a specified a group of operators, to aspecified processing element that includes one or more operators, or toall operators in the streaming application. We assume the streamingapplication 900 runs at less than 80% resource usage, but due toincreased demand, the performance of streaming application 900 grows toexceed 80% resource usage. In response to the performance of thestreaming application 900 exceeding the 80% defined performancethreshold, the streams manager requests cloud resources to relieve theload on streaming application 900. How this is done depends on thesensitive data split criteria, as shown in the four specific examples inFIGS. 10-13 and discussed in detail below.

A first example in FIG. 10 applies the sensitive data split criteria 810in FIG. 8 that specifies that connected processing elements that do notprocess sensitive data can be split and moved to a public cloud. Weassume for the example in FIG. 10 that processing elements E, F and G donot process sensitive data. As a result, the streaming application 1000in FIG. 10 is shown split between the portion hosted on the dedicatedsystem 910, and the portion 1010 that has been moved to a public cloudbased on the sensitive data split criteria 810.

A second example in FIG. 11 applies the sensitive data split criteria820 in FIG. 8 that specifies that individual processing elements that donot process sensitive data can be split and moved to a public cloud. Weassume for the example in FIG. 11 that processing elements A and I donot process sensitive data. As a result, the streaming application 1100in FIG. 11 is shown split between the portion hosted on the dedicatedsystem 910, and the portions 1110 and 1112 that have been moved to apublic cloud based on the sensitive data split criteria 820.

A third example in FIG. 12 applies the sensitive data split criteria 830in FIG. 8 that specifies that processing elements that process sensitivedata can be encrypted and moved to a public cloud. We assume for theexample in FIG. 12 that processing elements B and C process sensitivedata, but could be moved to a public cloud by encrypting the data sentto processing element B and decrypting the data coming from processingelement C. Note this requires adding additional encryption anddecryption processing elements in the dedicated system 910, shown inFIG. 12 as Enc-B and Dec-C. As a result, the streaming application 1200in FIG. 12 is shown split between the portion hosted on the dedicatedsystem 910, and the portion 1210 that has been moved to a public cloudbased on the sensitive data split criteria 830.

A fourth example in FIG. 13 applies the sensitive data split criteria840 in FIG. 8 that specifies that processing elements that can beunfused so operators within the processing elements that do not processsensitive data can be encrypted and moved to a public cloud. We assumefor the example in FIG. 13 that processing element F includes threeoperators, F1, F2 and F3. By unfusing the processing element F into itsthree separate operators F1, F2 and F3, one or more of the unfusedoperators that do not process sensitive data may be moved to the publiccloud even when one or more of the unfused operators process sensitivedata. We assume for this example in FIG. 13 that operators F1 and F3 donot process sensitive data, but operator F2 does process sensitive data.We further assume that processing element E does not process sensitivedata. As a result, after unfusing processing element F into itsconstituent operators F1, F2 and F3, processing element E and operatorF1 can be moved to a public cloud, and operator F3 can be moved to apublic cloud, while operator F2, which processes sensitive data, remainsin the dedicated system 910. As a result, the streaming application 1300in FIG. 13 is shown split between the portion hosted on the dedicatedsystem 910, and the portions 1310 and 1312 that have been moved to apublic cloud based on the sensitive data split criteria 840.

In addition to unfusing processing elements, tuples may be split intoconstituent parts that can then be processed separately according towhether or not they include sensitive data. This example of sensitivedata split criteria is shown at 850 in FIG. 8. Referring to FIG. 14, atuple TupleFromE represents a tuple sent from processing element E toprocessing element F in FIG. 9. We assume for this simple example thatthe attributes Attr1 and Attr2 do not include sensitive data, and theattributes Attr3 and Attr4 include sensitive data, as shown in the tablein FIG. 15. For example, Attr3 and Attr4 could contain data such associal security number and telephone number, respectively, which couldbe considered sensitive data. For this example, we assume processingelement F processes Attr1 and Attr2, but does not process Attr3 orAttr4. With the information in FIG. 15 and knowing processing element Fdoes not process Attr3 or Attr4, it is possible to split the tuplesthemselves into different sets of attributes according to whether or notthe attributes contain sensitive data, with a first set of the tupleattributes including sensitive data and a second set of the tupleattributes not including sensitive data. This allows the attributes thatdo not include sensitive data to be processed by a cloned portion of theflow graph in a public cloud, while attributes that include sensitivedata are processed by a secure system. With the tuple attributes shownin FIGS. 14 and 15 for the tuple coming from processing element E, FIG.16 shows how the streams manager could create a cloned processingelement F′ in a public cloud 1610 that is a clone of processing elementF while keeping the other processing elements in the dedicated system910. Note the tuple attributes from processing element E are split, withAttr1 and Attr2 being routed to the cloned processing element F′ in thepublic cloud 1610, while Attr3 and Attr4 are routed to the originalprocessing element F in the dedicated system 910. Note the function ofthe original processing element F will be changed to receive Attr3 andAttr4 from processing element E, to receive Attr1 and Attr2 fromprocessing element F′ in the public cloud 1610, and to recombine theseinto a full tuple that includes all four attributes Attr1, Attr2, Attr3and Attr4. This allows tuples themselves to be split into separateattributes that may be processed separately then recombined to benefitfrom use of resources in a public cloud while protecting the integrityof sensitive data.

Referring to FIG. 17, a method 1700 is preferably performed by thestreams manager 360 in FIGS. 3 and 5. Method 1700 begins by determiningwhether tuples can be split based on sensitive data (step 1710). Next,determine any clones that may be needed to split the tuples based onsensitive data (step 1720). A determination is then made regardingwhether moving non-sensitive portions of tuples to a public cloud isprofitable (step 1730). This determination may be made in any suitableway using any suitable criteria, algorithm or heuristic. The generalconcept in step 1730 is simple to grasp: if the benefits of splittingtuples into two different attribute sets according to sensitive data andprocessing some on a dedicated system and others in a public cloud, thenrecombining the split tuple portions to make a full tuple again, are notgreater than the additional overhead, processing performance and cost ofmaking this change, the change is not made. Notice that “profitable” canbe defined in any suitable way using any suitable criteria orcombination of criteria. In other words, while a streams manager may beable to split tuples, it doesn't necessarily do so when splitting tuplesinto different attribute sets does not give enough of an advantage overthe existing configuration. When moving the non-sensitive portions oftuples to a public cloud is not profitable (step 1730=NO), method 1700is done. When moving the non-sensitive portions of tuples to a publiccloud is profitable (step 1730=YES), the streams manager clones one ormore selected portion(s) of the flow graph to a public cloud whilekeeping the selected portion(s) in the secure system, and splits thetuples between the public cloud and secure system based on sensitivedata (step 1740). Method 1700 is then done. Method 1700 illustratessteps the streams manager could take to start with the flow graph 900 inFIG. 9 and end up with the flow graph 1600 in FIG. 16.

The specific sensitive data split criteria 810, 820, 830, 840 and 850are shown by way of example, and are not limiting of the disclosure andclaims herein, which apply to any and all criteria that could bedeveloped for determining which portions of a flow graph may be split toa public cloud based on sensitive data, whether currently known ordeveloped in the future.

The disclosure and claims herein relate to a streams manager thatdetermines which portions of a streaming application process sensitivedata, and when performance of the streaming application needs to beincreased, selects based on the sensitive data which portion(s) of thestreaming application can be moved to a public cloud. The streamsmanager then interacts with the public cloud manager to move theselected portion(s) of the streaming application to the public cloud.This may include cloning of processing elements or operators to a publiccloud, then splitting tuple attributes so tuple attributes that do notinclude sensitive data can be processed in the public cloud while tupleattributes that include sensitive data are processed in a secure system.The tuple attributes are then recombined into full tuples in the securesystem. The streams manager thus protects the integrity of sensitivedata while still taking advantage of the additional resources availablein a public cloud.

One skilled in the art will appreciate that many variations are possiblewithin the scope of the claims. Thus, while the disclosure isparticularly shown and described above, it will be understood by thoseskilled in the art that these and other changes in form and details maybe made therein without departing from the spirit and scope of theclaims.

1-8. (canceled)
 9. A computer-implemented method executed by at leastone processor for executing a streaming application, the methodcomprising: executing the streaming application comprising a flow graphthat includes a plurality of processing elements that process aplurality of data tuples; monitoring performance of the plurality ofprocessing elements in the flow graph; identifying which of theplurality of processing elements in the flow graph process sensitivedata; defining at least one sensitive data split that specifies how tosplit the flow graph based on sensitive data so at least a portion ofthe flow graph can be moved to a public cloud in a manner that assuresthe sensitive data is not in the public cloud, wherein the at least onesensitive data split criterion specifies to split a plurality of tupleattributes corresponding to a selected data tuple between a first set ofthe plurality or tuple attributes that include sensitive data and asecond set of the plurality of tuple attributes that do not includesensitive data; and selecting based on the at least one sensitive datasplit criterion at least one portion of the flow graph to move to thepublic cloud when the monitored performance indicates performance of thestreaming application needs to be improved, and in response, moving theselected at least one portion of the flow graph to the public cloud bycreating at least one cloned portion of the flow graph in the publiccloud, routing the first set of the plurality of tuple attributes to aportion of the flow graph in a secure system, routing the second set ofthe plurality of tuple attributes to the at least one cloned portion ofthe flow graph in the public cloud, and recombining the first set of theplurality of tuple attributes and the second set of the plurality oftuple attributes into the selected tuple in the secure system.
 10. Themethod of claim 9 wherein the at least one sensitive data splitcriterion specifies to move to the public cloud connected processingelements in the flow graph that do not process sensitive data.
 11. Themethod of claim 9 wherein the at least one sensitive data splitcriterion specifies to move to the public cloud individual processingelements in the flow graph that do not process sensitive data.
 12. Themethod of claim 9 wherein the at least one sensitive data splitcriterion specifies to move to the public cloud connected processingelements in the flow graph that process sensitive data that can have adata input encrypted and a data output decrypted.
 13. The method ofclaim 9 wherein the at least one sensitive data split criterionspecifies to unfuse one of the plurality of processing elements into aplurality of operators so at least one of the plurality of operatorsthat does not process sensitive data is moved to the public cloud whileat least one of the plurality of operators that process sensitive datais not moved to the public cloud.
 14. The method of claim 9 whereinmoving the selected at least one portion of the flow graph to the publiccloud is performed by requesting a public cloud manager to provision atleast one virtual machine with logic to implement the selected at leastone portion of the flow graph, and when the public cloud managerprovisions the at least one virtual machine, the streams managermodifies the flow graph to include the at least one virtual machine inthe flow graph of the streaming application.
 15. The method of claim 9wherein determining when the monitored performance indicates performanceof the streaming application needs to be improved is performed bycomparing current performance of the streaming application to at leastone performance threshold.
 16. The method of claim 9 wherein determiningwhen the performance of the streaming application needs to be improvedis performed by comparing current performance of the streamingapplication to historical performance of the streaming application. 17.A computer-implemented method executed by at least one processor forexecuting a streaming application, the method comprising: executing thestreaming application comprising a flow graph that includes a pluralityof processing elements that process a plurality of data tuples;monitoring performance of the plurality of processing elements in theflow graph; identifying which of the plurality of processing elements inthe flow graph process sensitive data; defining a plurality of sensitivedata split criteria that specify how to split the flow graph based onsensitive data so at least a portion of the flow graph can be moved to apublic cloud in a manner that assures the sensitive data is not in thepublic cloud, the sensitive split criteria including: specifying to moveto the public cloud connected processing elements in the flow graph thatdo not process sensitive data; specifying to move to the public cloudindividual processing elements in the flow graph that do not processsensitive data; specifying to move to the public cloud connectedprocessing elements in the flow graph that process sensitive data thatcan have a data input encrypted and a data output decrypted; specifyingto unfuse one of the plurality of processing elements into a pluralityof operators so at least one of the plurality of operators that does notprocess sensitive data is moved to the public cloud while at least oneof the plurality of operators that process sensitive data is not movedto the public cloud; and specifying to split a plurality of tupleattributes corresponding to a selected data tuple between a first set ofthe plurality or tuple attributes that include sensitive data and asecond set of the plurality of tuple attributes that do not includesensitive data; selecting based on the sensitive data split criteria atleast one portion of the flow graph to move to the public cloud when themonitored performance indicates performance of the streaming applicationneeds to be improved by comparing current performance of the streamingapplication to at least one performance threshold and by comparingcurrent performance of the streaming application to historicalperformance of the streaming application; and moving the selected atleast one portion of the flow graph to the public cloud by requesting apublic cloud manager to provision at least one virtual machine withlogic to implement the selected at least one portion of the flow graph,and when the public cloud manager provisions the at least one virtualmachine, modifying the flow graph to include the at least one virtualmachine in the flow graph of the streaming application, creating atleast one cloned portion of the flow graph in the public cloud, routingthe first set of the plurality of tuple attributes to a portion of theflow graph in a secure system, routing the second set of the pluralityof tuple attributes to the at least one cloned portion of the flow graphin the public cloud, and recombining the first set of the plurality oftuple attributes and the second set of the plurality of tuple attributesinto the selected tuple in the secure system.